Health N Tech Transformation
strategy institute
Joaquim Cardoso MSc
Chief Researcher, Editor and Senior Advisor
May 26, 2023
ONE PAGE SUMMARY
Based on the article “Meta’s fine has repercussions for EU-US data flows”, published on Financial Times.
This executive summary discusses the implications of the €1.2 billion fine imposed on Meta (formerly Facebook) under EU data protection rules and its impact on data flows between the European Union (EU) and the United States (US).
The fine highlights the absence of a functional legal framework for Meta and numerous other companies to transfer EU user data to the US.
The lack of a solution could have significant consequences for tech firms, consumers, and the internet as a whole.
The crux of the issue lies in the disparity between EU and US laws regarding data protection.
EU law prohibits the transfer of personal data to third countries unless they offer “adequate” levels of data protection, which are considerably higher than those provided by the US.
Previous EU-US frameworks, such as Safe Harbor and Privacy Shield, were struck down by the European Court of Justice due to their failure to meet the “essentially equivalent” requirements of EU law.
Facebook continued transfers based on contractual clauses endorsed by the European Commission, but concerns were raised about their validity.
In the recent ruling, Meta has been instructed to suspend data transfers to the US within five months and cease processing EU citizens’ data previously sent there within six months.
While some European campaigners argue for the deletion of the data in the US, Meta plans to appeal the decision. The company, along with other tech firms, is hopeful that a new EU-US data privacy framework set to be implemented will withstand legal challenges. However, privacy activist Max Schrems has indicated his intention to test the new framework.
There are potential paths forward to resolve this issue
President Joe Biden’s executive order signed in October 2022 aims to enhance safeguards around US intelligence gathering and establishes a court for citizens to seek redress.
Some EU experts believe this new framework could meet the requirement of being “essentially equivalent” to EU standards.
However, if it falls short, it would require either significant reform of US intelligence laws or a dilution of the EU’s General Data Protection Regulation (GDPR), both of which present political challenges.
Without a viable solution, companies may face the obligation to store all EU personal data on EU servers, potentially hindering various activities such as cross-border social networks and the sharing of clinical trial data.
The EU emphasizes its world-leading data privacy standards, while the US argues for the protection of security activities that benefit allies.
Both sides must find a way to ensure the continued legal flow of necessary personal data.
While digital decoupling between the West and China may be inevitable, it would be unfortunate to witness a fracture of the internet between the world’s leading democracies.
In conclusion, the significant fine imposed on Meta underscores the urgent need to establish a workable legal framework for EU-US data transfers.
Failure to find a solution could have profound implications for tech companies, consumers, and the internet as a whole.
It is crucial for Brussels and Washington to collaborate and devise a mutually agreeable framework that addresses data protection concerns while allowing for the necessary flow of personal data between the EU and the US.
